@zaflun/lumio-sdk 0.6.3 → 0.10.0

package/dist/lumio-runtime.global.js

@@ -31,9 +31,9 @@
     mod
   ));
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react.production.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react.production.js
   var require_react_production = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react.production.js"(exports$1) {
       var REACT_ELEMENT_TYPE = /* @__PURE__ */ Symbol.for("react.transitional.element");
       var REACT_PORTAL_TYPE = /* @__PURE__ */ Symbol.for("react.portal");
       var REACT_FRAGMENT_TYPE = /* @__PURE__ */ Symbol.for("react.fragment");
@@ -467,22 +467,22 @@
       exports$1.useTransition = function() {
         return ReactSharedInternals.H.useTransition();
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/index.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/index.js
   var require_react = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/index.js"(exports$1, module) {
       {
         module.exports = require_react_production();
       }
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react-jsx-runtime.production.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react-jsx-runtime.production.js
   var require_react_jsx_runtime_production = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/cjs/react-jsx-runtime.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/cjs/react-jsx-runtime.production.js"(exports$1) {
       var REACT_ELEMENT_TYPE = /* @__PURE__ */ Symbol.for("react.transitional.element");
       var REACT_FRAGMENT_TYPE = /* @__PURE__ */ Symbol.for("react.fragment");
       function jsxProd(type, config2, maybeKey) {
@@ -509,9 +509,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react@19.2.5/node_modules/react/jsx-runtime.js
+  // ../../node_modules/.pnpm/react@19.2.8/node_modules/react/jsx-runtime.js
   var require_jsx_runtime = __commonJS({
-    "../../node_modules/.pnpm/react@19.2.5/node_modules/react/jsx-runtime.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react@19.2.8/node_modules/react/jsx-runtime.js"(exports$1, module) {
       {
         module.exports = require_react_jsx_runtime_production();
       }
@@ -799,9 +799,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom.production.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom.production.js
   var require_react_dom_production = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom.production.js"(exports$1) {
       var React33 = require_react();
       function formatProdErrorMessage(code) {
         var url2 = "https://react.dev/errors/" + code;
@@ -943,13 +943,13 @@
       exports$1.useFormStatus = function() {
         return ReactSharedInternals.H.useHostTransitionStatus();
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/index.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/index.js
   var require_react_dom = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/index.js"(exports$1, module) {
       function checkDCE() {
         if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ === "undefined" || typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE !== "function") {
           return;
@@ -967,9 +967,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom-client.production.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom-client.production.js
   var require_react_dom_client_production = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/cjs/react-dom-client.production.js"(exports$1) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/cjs/react-dom-client.production.js"(exports$1) {
       var Scheduler = require_scheduler();
       var React33 = require_react();
       var ReactDOM = require_react_dom();
@@ -12608,12 +12608,12 @@
         }
       };
       var isomorphicReactPackageVersion$jscomp$inline_1840 = React33.version;
-      if ("19.2.5" !== isomorphicReactPackageVersion$jscomp$inline_1840)
+      if ("19.2.8" !== isomorphicReactPackageVersion$jscomp$inline_1840)
         throw Error(
           formatProdErrorMessage(
             527,
             isomorphicReactPackageVersion$jscomp$inline_1840,
-            "19.2.5"
+            "19.2.8"
           )
         );
       ReactDOMSharedInternals.findDOMNode = function(componentOrElement) {
@@ -12631,10 +12631,10 @@
       };
       var internals$jscomp$inline_2347 = {
         bundleType: 0,
-        version: "19.2.5",
+        version: "19.2.8",
         rendererPackageName: "react-dom",
         currentDispatcherRef: ReactSharedInternals,
-        reconcilerVersion: "19.2.5"
+        reconcilerVersion: "19.2.8"
       };
       if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
         hook$jscomp$inline_2348 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
@@ -12702,13 +12702,13 @@
         listenToAllSupportedEvents(container);
         return new ReactDOMHydrationRoot(initialChildren);
       };
-      exports$1.version = "19.2.5";
+      exports$1.version = "19.2.8";
     }
   });
 
-  // ../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/client.js
+  // ../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/client.js
   var require_client = __commonJS({
-    "../../node_modules/.pnpm/react-dom@19.2.5_react@19.2.5/node_modules/react-dom/client.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-dom@19.2.8_react@19.2.8/node_modules/react-dom/client.js"(exports$1, module) {
       function checkDCE() {
         if (typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ === "undefined" || typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE !== "function") {
           return;
@@ -13007,9 +13007,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/cjs/react-reconciler.production.js
+  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/cjs/react-reconciler.production.js
   var require_react_reconciler_production = __commonJS({
-    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/cjs/react-reconciler.production.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/cjs/react-reconciler.production.js"(exports$1, module) {
       module.exports = function($$$config) {
         function createFiber(tag, pendingProps, key, mode) {
           return new FiberNode(tag, pendingProps, key, mode);
@@ -20834,9 +20834,9 @@
     }
   });
 
-  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/index.js
+  // ../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/index.js
   var require_react_reconciler = __commonJS({
-    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.5/node_modules/react-reconciler/index.js"(exports$1, module) {
+    "../../node_modules/.pnpm/react-reconciler@0.32.0_react@19.2.8/node_modules/react-reconciler/index.js"(exports$1, module) {
       {
         module.exports = require_react_reconciler_production();
       }
@@ -20901,6 +20901,7 @@
     useLumioTheme: () => useLumioTheme,
     useMutation: () => useMutation,
     useQuery: () => useQuery,
+    useRealtime: () => useRealtime,
     useVisionState: () => useVisionState
   });
 
@@ -20909,6 +20910,15 @@
   var RENDER_TIMEOUT_MS = 1e4;
   var hasRendered = false;
   var renderTimeout = null;
+  function hostOrigin() {
+    try {
+      if (typeof document !== "undefined" && document.referrer) {
+        return new URL(document.referrer).origin;
+      }
+    } catch {
+    }
+    return "*";
+  }
   function startRenderTimeout() {
     if (renderTimeout) return;
     renderTimeout = setTimeout(() => {
@@ -20922,7 +20932,7 @@
             code: "RENDER_TIMEOUT",
             message: "Extension did not render within 10 seconds"
           },
-          "*"
+          hostOrigin()
         );
       }
     }, RENDER_TIMEOUT_MS);
@@ -20945,7 +20955,7 @@
       }
       const root = (0, import_client.createRoot)(rootElement);
       root.render(element);
-      window.parent.postMessage({ type: "READY" }, "*");
+      window.parent.postMessage({ type: "READY" }, hostOrigin());
     }
   };
 
@@ -21297,6 +21307,7 @@
   // src/renderer/bridge-context.ts
   var bridgeInstance = null;
   var registryInstance = null;
+  var initParams = null;
   function getBridge() {
     if (!bridgeInstance) {
       bridgeInstance = new WorkerBridge();
@@ -21309,6 +21320,15 @@
     }
     return registryInstance;
   }
+  function setInitParams(params) {
+    const rest = { ...params };
+    delete rest.bundleCode;
+    delete rest.bundleUrl;
+    initParams = rest;
+  }
+  function getInitParams() {
+    return initParams;
+  }
   function destroyBridgeContext() {
     if (bridgeInstance) {
       bridgeInstance.destroy();
@@ -21318,6 +21338,7 @@
       registryInstance.clear();
       registryInstance = null;
     }
+    initParams = null;
   }
 
   // src/hooks/useEditorAction.ts
@@ -21359,24 +21380,36 @@
   // ../protocol/dist/index.js
   var dist_exports = {};
   __export(dist_exports, {
+    ACTION_EXECUTE_ERRORS: () => ACTION_EXECUTE_ERRORS,
     ACTION_TYPES: () => ACTION_TYPES,
+    EXTENSION_RUNTIME_LABEL_PLACEHOLDER: () => EXTENSION_RUNTIME_LABEL_PLACEHOLDER,
     HOST_METHODS: () => HOST_METHODS,
     LUMIO_COMPONENT_TYPES: () => LUMIO_COMPONENT_TYPES,
+    LUMIO_EVENT_PAYLOAD_SCHEMAS: () => LUMIO_EVENT_PAYLOAD_SCHEMAS,
     LUMIO_EVENT_TYPES: () => LUMIO_EVENT_TYPES,
     MESSAGE_TYPES: () => MESSAGE_TYPES,
+    REALTIME_LIMITS: () => REALTIME_LIMITS,
+    SERVER_FUNCTION_ERRORS: () => SERVER_FUNCTION_ERRORS,
     STORAGE_SCOPES: () => STORAGE_SCOPES,
     WORKER_METHODS: () => WORKER_METHODS,
     actionMessageSchema: () => actionMessageSchema,
+    chatMessagePayloadSchema: () => chatMessagePayloadSchema,
     configUpdateMessageSchema: () => configUpdateMessageSchema,
     errorMessageSchema: () => errorMessageSchema,
     eventMessageSchema: () => eventMessageSchema,
     extensionConfigSchema: () => extensionConfigSchema,
+    extensionRuntimeLabel: () => extensionRuntimeLabel,
+    extensionRuntimeOrigin: () => extensionRuntimeOrigin,
+    extensionRuntimeOriginLabel: () => extensionRuntimeOriginLabel,
     initMessageSchema: () => initMessageSchema,
+    isValidExtensionRuntimeOriginTemplate: () => isValidExtensionRuntimeOriginTemplate,
     lumioActionTypeSchema: () => lumioActionTypeSchema,
+    lumioEventPayloadSchema: () => lumioEventPayloadSchema,
     lumioEventTypeSchema: () => lumioEventTypeSchema,
     lumioMessageSchema: () => lumioMessageSchema,
     nodeConfigRequestMessageSchema: () => nodeConfigRequestMessageSchema,
     nodeConfigUpdateMessageSchema: () => nodeConfigUpdateMessageSchema,
+    parseLumioEventPayload: () => parseLumioEventPayload,
     readyMessageSchema: () => readyMessageSchema,
     storageScopeSchema: () => storageScopeSchema,
     storageUpdateMessageSchema: () => storageUpdateMessageSchema,
@@ -21387,6 +21420,50 @@
     themeSchema: () => themeSchema
   });
 
+  // ../protocol/dist/chunk-746VSR4E.js
+  var EXTENSION_RUNTIME_LABEL_PLACEHOLDER = "{label}";
+  var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+  var LABEL_PATTERN = /^[0-9a-f]{32}$/;
+  var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  var TEMPLATE_PATTERN = /^(https:\/\/|http:\/\/)\{label\}(\.[a-z0-9.-]+(?::[0-9]{1,5})?)$/;
+  function parseTemplate(template) {
+    const match = TEMPLATE_PATTERN.exec(template);
+    if (!match) return null;
+    const prefix = match[1];
+    const suffix = match[2];
+    const host = suffix.slice(1).replace(/:[0-9]+$/, "");
+    if (prefix === "http://" && host !== "localhost") return null;
+    if (!host.split(".").every((label) => DNS_LABEL_PATTERN.test(label))) return null;
+    const sample = `${prefix}${"0".repeat(32)}${suffix}`;
+    try {
+      if (new URL(sample).origin !== sample) return null;
+    } catch {
+      return null;
+    }
+    return { prefix, suffix };
+  }
+  function extensionRuntimeLabel(extensionId) {
+    if (typeof extensionId !== "string" || !UUID_PATTERN.test(extensionId)) return null;
+    return extensionId.replaceAll("-", "");
+  }
+  function extensionRuntimeOrigin(extensionId, template) {
+    const label = extensionRuntimeLabel(extensionId);
+    if (!label) return null;
+    const parsed = parseTemplate(template);
+    if (!parsed) return null;
+    return `${parsed.prefix}${label}${parsed.suffix}`;
+  }
+  function extensionRuntimeOriginLabel(origin, template) {
+    const parsed = parseTemplate(template);
+    if (!parsed) return null;
+    if (!origin.startsWith(parsed.prefix) || !origin.endsWith(parsed.suffix)) return null;
+    const label = origin.slice(parsed.prefix.length, origin.length - parsed.suffix.length);
+    return LABEL_PATTERN.test(label) ? label : null;
+  }
+  function isValidExtensionRuntimeOriginTemplate(template) {
+    return parseTemplate(template) !== null;
+  }
+
   // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.js
   var external_exports = {};
   __export(external_exports, {
@@ -22170,14 +22247,14 @@
   }
   function randomString(length = 10) {
     const chars = "abcdefghijklmnopqrstuvwxyz";
-    let str = "";
+    let str2 = "";
     for (let i = 0; i < length; i++) {
-      str += chars[Math.floor(Math.random() * chars.length)];
+      str2 += chars[Math.floor(Math.random() * chars.length)];
     }
-    return str;
+    return str2;
   }
-  function esc(str) {
-    return JSON.stringify(str);
+  function esc(str2) {
+    return JSON.stringify(str2);
   }
   function slugify(input) {
     return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -22277,8 +22354,8 @@
   };
   var propertyKeyTypes = /* @__PURE__ */ new Set(["string", "number", "symbol"]);
   var primitiveTypes = /* @__PURE__ */ new Set(["string", "number", "bigint", "boolean", "symbol", "undefined"]);
-  function escapeRegex(str) {
-    return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  function escapeRegex(str2) {
+    return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   }
   function clone(inst, def, params) {
     const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -35178,7 +35255,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     extension_id: external_exports.string(),
     install_id: external_exports.string(),
     account_id: external_exports.string(),
-    target: external_exports.enum(["editor", "layer", "interactive"]),
+    target: external_exports.enum(["editor", "layer"]),
     permissions: external_exports.array(external_exports.string()),
     settings: external_exports.record(external_exports.string(), external_exports.unknown())
   });
@@ -35258,11 +35335,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     // Twitch
     "twitch:follower",
     "twitch:subscribe",
-    "twitch:gift_sub",
+    "twitch:gift",
     "twitch:resub",
     "twitch:cheer",
     "twitch:raid",
     "twitch:reward",
+    // Redemption status change (fulfilled / canceled) and reward lifecycle
+    // (created / updated / deleted on Twitch) — ZAF-2393. The lifecycle types are
+    // live-only (`broadcast_only`), never in the event history.
+    "twitch:reward_status",
+    "twitch:reward_add",
+    "twitch:reward_update",
+    "twitch:reward_remove",
     "twitch:hype_train",
     "twitch:hype_train_end",
     "twitch:poll",
@@ -35286,15 +35370,22 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "youtube:gift_membership",
     "youtube:gift_membership_received",
     "youtube:poll",
-    // Kick
+    // YouTube stream lifecycle (ZAF-1444 / ZAF-622 §75) — emitted by the poll-driven
+    // YouTube worker on the channel-status online/offline edge, mirroring Twitch/Kick.
+    "youtube:stream_online",
+    "youtube:stream_offline",
+    // Kick — the webhook receiver normalizes every Kick payload into these types
+    // (ZAF-1624): canonical fields on top, the original payload kept in `raw`.
     "kick:follower",
     "kick:subscribe",
+    "kick:resub",
     "kick:gift",
+    "kick:kicks",
+    "kick:reward",
+    "kick:reward_status",
     "kick:stream_online",
     "kick:stream_offline",
-    // Trovo
-    "trovo:subscribe",
-    "trovo:spell",
+    "kick:stream_update",
     // Spotify
     "spotify:track",
     "spotify:play",
@@ -35314,7 +35405,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "twitch:chat",
     "youtube:chat",
     "kick:chat",
-    "trovo:chat",
     // Chat (cross-platform catch-all — fires for ALL platforms)
     "chat:message"
   ];
@@ -35355,6 +35445,645 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "global"
   ];
   var storageScopeSchema = external_exports.enum(STORAGE_SCOPES);
+  var str = external_exports.string();
+  var num = external_exports.number();
+  var bool = external_exports.boolean();
+  var nullableStr = external_exports.string().nullable();
+  var twitchBroadcaster = {
+    broadcaster_user_id: str,
+    broadcaster_user_login: str,
+    broadcaster_user_name: str
+  };
+  var twitchUser = {
+    user_id: str,
+    user_login: str,
+    user_name: str
+  };
+  var avatarUrl = { avatarUrl: str.optional() };
+  var twitchBadge = external_exports.looseObject({ set_id: str, id: str, info: str });
+  var twitchChatNotice = {
+    ...twitchBroadcaster,
+    ...twitchUser,
+    ...avatarUrl,
+    chatter_user_id: str,
+    chatter_user_login: str,
+    chatter_user_name: str,
+    chatter_is_anonymous: bool,
+    color: str,
+    badges: external_exports.array(twitchBadge),
+    message: external_exports.looseObject({ text: str, fragments: external_exports.array(external_exports.unknown()) }),
+    message_id: str,
+    notice_type: str,
+    system_message: str,
+    /** Emotes of `message`, normalised like chat-message emotes (ZAF-1306). */
+    emotes: external_exports.array(external_exports.unknown()).optional()
+  };
+  var twitchImage = external_exports.looseObject({ url_1x: str, url_2x: str, url_4x: str });
+  var twitchEnabledValue = external_exports.looseObject({ is_enabled: bool, value: num });
+  var twitchRewardDefinition = external_exports.looseObject({
+    ...twitchBroadcaster,
+    id: str,
+    title: str,
+    cost: num,
+    prompt: str,
+    background_color: str,
+    is_enabled: bool,
+    is_paused: bool,
+    is_in_stock: bool,
+    is_user_input_required: bool,
+    should_redemptions_skip_request_queue: bool,
+    max_per_stream: twitchEnabledValue,
+    max_per_user_per_stream: twitchEnabledValue,
+    global_cooldown: external_exports.looseObject({ is_enabled: bool, seconds: num }),
+    image: twitchImage.nullable(),
+    default_image: twitchImage,
+    cooldown_expires_at: nullableStr,
+    redemptions_redeemed_current_stream: num.nullable()
+  });
+  var twitchRedemption = external_exports.looseObject({
+    ...twitchBroadcaster,
+    ...twitchUser,
+    ...avatarUrl,
+    id: str,
+    user_input: str,
+    status: str,
+    redeemed_at: str,
+    reward: external_exports.looseObject({ id: str, title: str, cost: num, prompt: str })
+  });
+  var twitchPollVoting = external_exports.looseObject({ is_enabled: bool, amount_per_vote: num });
+  var twitchPollBase = {
+    ...twitchBroadcaster,
+    id: str,
+    title: str,
+    choices: external_exports.array(
+      external_exports.looseObject({
+        id: str,
+        title: str,
+        votes: num.optional(),
+        bits_votes: num.optional(),
+        channel_points_votes: num.optional()
+      })
+    ),
+    bits_voting: twitchPollVoting,
+    channel_points_voting: twitchPollVoting,
+    started_at: str
+  };
+  var twitchPredictionOutcome = external_exports.looseObject({
+    id: str,
+    title: str,
+    color: str,
+    users: num.optional(),
+    channel_points: num.optional(),
+    top_predictors: external_exports.array(
+      external_exports.looseObject({
+        ...twitchUser,
+        channel_points_used: num,
+        channel_points_won: num.nullable()
+      })
+    ).nullable().optional()
+  });
+  var twitchPredictionBase = {
+    ...twitchBroadcaster,
+    id: str,
+    title: str,
+    outcomes: external_exports.array(twitchPredictionOutcome),
+    started_at: str
+  };
+  var twitchGoalBase = {
+    ...twitchBroadcaster,
+    id: str,
+    type: str,
+    description: str,
+    current_amount: num,
+    target_amount: num,
+    started_at: str
+  };
+  var twitchHypeTrainBase = {
+    ...twitchBroadcaster,
+    id: str,
+    type: str,
+    level: num,
+    total: num,
+    top_contributions: external_exports.array(
+      external_exports.looseObject({ ...twitchUser, type: str, total: num })
+    ),
+    started_at: str,
+    is_shared_train: bool,
+    shared_train_participants: external_exports.array(external_exports.unknown()).nullable()
+  };
+  var moderationLogEntry = external_exports.looseObject({
+    action: str,
+    platform: str,
+    target_user_id: nullableStr,
+    target_username: nullableStr,
+    target_display_name: nullableStr,
+    moderator_name: str,
+    moderator_login: nullableStr,
+    reason: nullableStr,
+    duration_secs: num.nullable(),
+    ends_at: nullableStr,
+    target_message_id: nullableStr,
+    created_at: str
+  });
+  var chatMessagePayloadSchema = external_exports.looseObject({
+    account_id: str,
+    platform: str,
+    channel_name: nullableStr,
+    user_id: nullableStr,
+    username: str,
+    display_name: nullableStr,
+    avatar_url: nullableStr,
+    message: str,
+    /** Platform-specific emote entries. */
+    emotes: external_exports.array(external_exports.unknown()).nullable(),
+    /** Twitch GIF fragments `{ id, url, provider, alt }`; absent without a GIF. */
+    gifs: external_exports.array(external_exports.unknown()).optional(),
+    /** Platform-specific badge entries. */
+    badges: external_exports.array(external_exports.unknown()).nullable(),
+    color: nullableStr,
+    is_mod: bool,
+    is_sub: bool,
+    is_vip: bool,
+    sub_tier: nullableStr,
+    platform_message_id: nullableStr,
+    lumio_user_id: nullableStr,
+    reply_parent_msg_id: nullableStr,
+    reply_parent_username: nullableStr,
+    reply_parent_login: nullableStr,
+    reply_parent_message: nullableStr,
+    created_at: nullableStr,
+    message_type: nullableStr,
+    user_treatment: nullableStr,
+    live_chat_id: str.optional(),
+    is_shared_chat: bool.optional(),
+    source_channel: external_exports.unknown().optional(),
+    announcement_color: external_exports.unknown().optional()
+  });
+  var kickUser = external_exports.looseObject({
+    user_id: num,
+    username: str,
+    channel_slug: str,
+    is_verified: bool,
+    profile_picture: str,
+    is_anonymous: bool.optional(),
+    identity: external_exports.unknown().optional()
+  });
+  var kickCanonicalUser = {
+    user_id: str,
+    user_login: str,
+    user_name: str,
+    is_anonymous: bool
+  };
+  var kickSubscription = external_exports.looseObject({
+    ...kickCanonicalUser,
+    ...avatarUrl,
+    broadcaster: kickUser,
+    subscriber: kickUser,
+    duration: num,
+    cumulative_months: num,
+    created_at: str,
+    expires_at: str
+  });
+  var kickRedemption = external_exports.looseObject({
+    ...kickCanonicalUser,
+    broadcaster: kickUser,
+    redeemer: kickUser,
+    id: str,
+    user_input: str,
+    status: str,
+    redeemed_at: str,
+    reward: external_exports.looseObject({ id: str, title: str, cost: num })
+  });
+  var spotifySource = {
+    source: str.optional(),
+    extension_id: str.optional(),
+    install_id: str.optional()
+  };
+  var spotifyTrackInfo = {
+    action: str,
+    track_id: str,
+    track_name: str,
+    artist: str,
+    album: str,
+    album_art: str,
+    song_url: str
+  };
+  var youtubeAuthor = {
+    user_id: str,
+    user_login: str,
+    displayName: str,
+    avatarUrl: str
+  };
+  var LUMIO_EVENT_PAYLOAD_SCHEMAS = {
+    // Twitch
+    "twitch:follower": external_exports.looseObject({
+      ...twitchBroadcaster,
+      ...twitchUser,
+      ...avatarUrl,
+      followed_at: str
+    }),
+    "twitch:subscribe": external_exports.looseObject({
+      ...twitchChatNotice,
+      tier: str,
+      duration_months: num,
+      is_prime: bool.optional(),
+      sub: external_exports.looseObject({ sub_tier: str, is_prime: bool, duration_months: num })
+    }),
+    "twitch:gift": external_exports.looseObject({
+      ...twitchChatNotice,
+      /** Sub tier (`1000`, `2000`, `3000`). */
+      tier: str.optional(),
+      duration_months: num.optional(),
+      /** Gifts in a community gift (`community_sub_gift`). */
+      total: num.optional(),
+      /** The gifter's all-time gift count; `null` when anonymous. */
+      cumulative_total: num.nullable().optional(),
+      community_gift_id: nullableStr.optional(),
+      /** Set for a single gift (`sub_gift`), absent for a community gift. */
+      recipient_user_id: str.optional(),
+      recipient_user_login: str.optional(),
+      recipient_user_name: str.optional()
+    }),
+    "twitch:resub": external_exports.looseObject({
+      ...twitchChatNotice,
+      cumulative_months: num,
+      duration_months: num,
+      streak_months: num.nullable(),
+      is_gift: bool,
+      tier: str.optional(),
+      is_prime: bool.optional(),
+      gifter_is_anonymous: bool.nullable(),
+      gifter_user_login: nullableStr,
+      gifter_user_name: nullableStr,
+      resub: external_exports.looseObject({
+        cumulative_months: num,
+        duration_months: num,
+        streak_months: num.nullable(),
+        sub_plan: str,
+        is_gift: bool
+      })
+    }),
+    "twitch:cheer": external_exports.looseObject({
+      ...twitchBroadcaster,
+      ...avatarUrl,
+      user_id: nullableStr,
+      user_login: nullableStr,
+      user_name: nullableStr,
+      is_anonymous: bool,
+      bits: num,
+      message: str,
+      /** Cheermote entries for the cheer words in `message` (`kind: "cheermote"`). */
+      emotes: external_exports.array(external_exports.unknown()).optional(),
+      /** The cheermote for the total, when the channel's cheermotes loaded. */
+      cheermote: external_exports.unknown().optional()
+    }),
+    "twitch:raid": external_exports.looseObject({
+      from_broadcaster_user_id: str,
+      from_broadcaster_user_login: str,
+      from_broadcaster_user_name: str,
+      to_broadcaster_user_id: str,
+      to_broadcaster_user_login: str,
+      to_broadcaster_user_name: str,
+      viewers: num,
+      ...avatarUrl,
+      displayName: str.optional(),
+      /** The raider's channel info from Helix, when it loaded. */
+      title: str.optional(),
+      category: str.optional()
+    }),
+    "twitch:reward": twitchRedemption,
+    "twitch:reward_status": twitchRedemption,
+    "twitch:reward_add": twitchRewardDefinition,
+    "twitch:reward_update": twitchRewardDefinition,
+    "twitch:reward_remove": twitchRewardDefinition,
+    "twitch:hype_train": external_exports.looseObject({
+      ...twitchHypeTrainBase,
+      progress: num,
+      goal: num,
+      expires_at: str,
+      all_time_high_level: num.optional(),
+      all_time_high_total: num.optional()
+    }),
+    "twitch:hype_train_end": external_exports.looseObject({
+      ...twitchHypeTrainBase,
+      ended_at: str,
+      cooldown_ends_at: str
+    }),
+    "twitch:poll": external_exports.looseObject({ ...twitchPollBase, ends_at: str }),
+    "twitch:poll_end": external_exports.looseObject({
+      ...twitchPollBase,
+      status: str,
+      ended_at: str
+    }),
+    "twitch:prediction": external_exports.looseObject({ ...twitchPredictionBase, locks_at: str }),
+    "twitch:prediction_lock": external_exports.looseObject({
+      ...twitchPredictionBase,
+      locked_at: str
+    }),
+    "twitch:prediction_end": external_exports.looseObject({
+      ...twitchPredictionBase,
+      status: str,
+      ended_at: str,
+      winning_outcome_id: nullableStr
+    }),
+    "twitch:goal": external_exports.looseObject(twitchGoalBase),
+    "twitch:goal_end": external_exports.looseObject({
+      ...twitchGoalBase,
+      ended_at: str,
+      is_achieved: bool
+    }),
+    "twitch:ad_break": external_exports.looseObject({
+      ...twitchBroadcaster,
+      requester_user_id: str,
+      requester_user_login: str,
+      requester_user_name: str,
+      /** Seconds; Twitch's own sample payload sends it as a string. */
+      duration_seconds: external_exports.union([num, str]),
+      /** Twitch's own sample payload sends it as a string. */
+      is_automatic: external_exports.union([bool, str]),
+      started_at: str
+    }),
+    "twitch:ban": moderationLogEntry,
+    "twitch:unban": moderationLogEntry,
+    "twitch:stream_online": external_exports.looseObject({
+      ...twitchBroadcaster,
+      id: str,
+      type: str,
+      started_at: str,
+      /** Channel info from Helix, when it loaded. */
+      title: str.optional(),
+      category: str.optional()
+    }),
+    "twitch:stream_offline": external_exports.looseObject({
+      ...twitchBroadcaster,
+      /** Set when the stream's start is known. */
+      started_at: str.optional(),
+      duration_seconds: num.optional()
+    }),
+    "twitch:stream_update": external_exports.looseObject({
+      ...twitchBroadcaster,
+      title: str,
+      language: str,
+      category_id: str,
+      category_name: str,
+      content_classification_labels: external_exports.array(str),
+      tags: external_exports.array(str).optional(),
+      /** Diff against the previous channel info, when it was known. */
+      title_changed: bool.optional(),
+      category_changed: bool.optional(),
+      language_changed: bool.optional(),
+      tags_changed: bool.optional(),
+      old_title: str.optional(),
+      old_category_name: str.optional(),
+      old_tags: external_exports.array(str).optional()
+    }),
+    // YouTube
+    "youtube:subscribe": external_exports.looseObject({
+      channel_id: str,
+      video_id: str,
+      title: str,
+      published: str,
+      updated: str
+    }),
+    "youtube:member": external_exports.looseObject({
+      ...youtubeAuthor,
+      membership_event_type: str,
+      memberLevelName: nullableStr,
+      memberMonth: num.nullable(),
+      isUpgrade: bool,
+      display_message: str,
+      userComment: str
+    }),
+    "youtube:superchat": external_exports.looseObject({
+      ...youtubeAuthor,
+      amountMicros: num,
+      amountDisplayString: str,
+      currency: str,
+      tier: num,
+      userComment: str,
+      headerBackgroundColor: num,
+      bodyBackgroundColor: num
+    }),
+    "youtube:supersticker": external_exports.looseObject({
+      ...youtubeAuthor,
+      amountMicros: num,
+      amountDisplayString: str,
+      currency: str,
+      stickerName: str,
+      stickerUrl: str
+    }),
+    "youtube:gift_membership": external_exports.looseObject({
+      ...youtubeAuthor,
+      giftCount: num,
+      isGift: bool,
+      gift_memberships_level_name: nullableStr
+    }),
+    /** Stored in the event history only; never broadcast live (no fixture). */
+    "youtube:gift_membership_received": external_exports.looseObject({
+      user_id: nullableStr,
+      user_login: nullableStr,
+      displayName: str,
+      avatarUrl: nullableStr,
+      gifter_channel_id: nullableStr,
+      gifter_display_name: nullableStr,
+      gift_memberships_level_name: nullableStr
+    }),
+    "youtube:poll": external_exports.looseObject({
+      poll_id: str,
+      question: str,
+      status: str,
+      options: external_exports.array(
+        external_exports.looseObject({
+          option_text: str,
+          tally: nullableStr,
+          vote_ratio: num.nullable()
+        })
+      )
+    }),
+    "youtube:stream_online": external_exports.looseObject({
+      broadcast_id: str,
+      started_at: str,
+      title: str.optional(),
+      category: str.optional()
+    }),
+    "youtube:stream_offline": external_exports.looseObject({
+      broadcast_id: str,
+      started_at: str.optional(),
+      duration_seconds: num.optional()
+    }),
+    // Kick
+    "kick:follower": external_exports.looseObject({
+      ...kickCanonicalUser,
+      ...avatarUrl,
+      broadcaster: kickUser,
+      follower: kickUser
+    }),
+    "kick:subscribe": kickSubscription,
+    "kick:resub": kickSubscription,
+    "kick:gift": external_exports.looseObject({
+      ...kickCanonicalUser,
+      ...avatarUrl,
+      broadcaster: kickUser,
+      gifter: kickUser,
+      giftees: external_exports.array(kickUser),
+      /** Usernames of `giftees`. */
+      giftRecipients: external_exports.array(str),
+      giftCount: num,
+      total: num,
+      isGift: bool,
+      is_gift: bool,
+      /** The first giftee. */
+      recipient_user_id: str.optional(),
+      recipient_user_login: str.optional(),
+      recipient_user_name: str.optional(),
+      created_at: str,
+      expires_at: str
+    }),
+    "kick:kicks": external_exports.looseObject({
+      ...kickCanonicalUser,
+      ...avatarUrl,
+      broadcaster: kickUser,
+      sender: kickUser,
+      gift: external_exports.looseObject({
+        amount: num,
+        name: str,
+        type: str,
+        tier: str,
+        message: str,
+        pinned_time_seconds: num
+      }),
+      kicks: num,
+      message: str,
+      kick_gift_id: str,
+      kick_gift_name: str,
+      kick_gift_type: str,
+      kick_gift_tier: str,
+      kick_gift_color: str,
+      kick_gift_image: external_exports.looseObject({ static: str, animated: str }),
+      kick_pinned_time_seconds: num,
+      created_at: str
+    }),
+    "kick:reward": kickRedemption,
+    "kick:reward_status": kickRedemption,
+    "kick:stream_online": external_exports.looseObject({
+      broadcaster: kickUser,
+      is_live: bool,
+      title: str,
+      started_at: str,
+      ended_at: nullableStr
+    }),
+    "kick:stream_offline": external_exports.looseObject({
+      broadcaster: kickUser,
+      is_live: bool,
+      title: str,
+      started_at: str,
+      ended_at: str,
+      duration_seconds: num.optional()
+    }),
+    "kick:stream_update": external_exports.looseObject({
+      broadcaster: kickUser,
+      metadata: external_exports.looseObject({
+        title: str,
+        language: str,
+        has_mature_content: bool,
+        category: external_exports.looseObject({ id: num, name: str, thumbnail: str })
+      }),
+      title: str,
+      language: str,
+      has_mature_content: bool,
+      category_id: str,
+      category_name: str,
+      /** Diff against the previous stream info, when it was known. */
+      title_changed: bool.optional(),
+      category_changed: bool.optional(),
+      language_changed: bool.optional(),
+      old_title: str.optional()
+    }),
+    // Spotify
+    "spotify:track": external_exports.looseObject({
+      is_playing: bool,
+      progress_ms: num,
+      timestamp: num,
+      shuffle: str,
+      repeat: str,
+      track: external_exports.looseObject({
+        id: str,
+        uri: str,
+        name: str,
+        artist: str,
+        album: str,
+        album_art: str,
+        duration_ms: num
+      }),
+      device: external_exports.looseObject({
+        id: str,
+        name: str,
+        device_type: str,
+        is_active: bool,
+        volume_percent: num.nullable()
+      }).nullable(),
+      context: external_exports.looseObject({ context_type: str, id: str, name: nullableStr, uri: str }).nullable(),
+      /** The Lumio user whose action caused the change; `null` when it came from Spotify. */
+      triggered_by: nullableStr.optional()
+    }),
+    "spotify:play": external_exports.looseObject({
+      ...spotifyTrackInfo,
+      ...spotifySource,
+      track_uri: str
+    }),
+    "spotify:pause": external_exports.looseObject({ ...spotifyTrackInfo, ...spotifySource }),
+    "spotify:skip": external_exports.looseObject({ action: str, ...spotifySource }),
+    "spotify:volume": external_exports.looseObject({
+      ...spotifyTrackInfo,
+      ...spotifySource,
+      oldVolume: num,
+      newVolume: num,
+      volume_percent: num
+    }),
+    "spotify:queue_add": external_exports.looseObject({ uri: str, ...spotifySource }),
+    "spotify:device": external_exports.looseObject({
+      fromDevice: str,
+      fromDeviceType: str,
+      toDevice: str,
+      toDeviceType: str
+    }),
+    "spotify:playlist_add": external_exports.looseObject({ playlistId: str }),
+    "spotify:playlist_remove": external_exports.looseObject({ playlistId: str, trackUri: str }),
+    "spotify:playlist_create": external_exports.looseObject({ playlistName: str }),
+    "spotify:playlist_edit": external_exports.looseObject({ playlistName: str }),
+    "spotify:playlist_delete": external_exports.looseObject({ playlistId: str }),
+    // StreamElements
+    "streamelements:tip": external_exports.looseObject({
+      _id: str,
+      channel: str,
+      provider: str,
+      type: str,
+      flagged: bool,
+      createdAt: str,
+      updatedAt: str,
+      data: external_exports.looseObject({
+        tipId: str,
+        username: str,
+        displayName: str,
+        providerId: str.optional(),
+        amount: num,
+        currency: str,
+        message: str,
+        avatar: str.optional()
+      })
+    }),
+    // Chat
+    "twitch:chat": chatMessagePayloadSchema,
+    "youtube:chat": chatMessagePayloadSchema,
+    "kick:chat": chatMessagePayloadSchema,
+    "chat:message": chatMessagePayloadSchema
+  };
+  function lumioEventPayloadSchema(type) {
+    return LUMIO_EVENT_PAYLOAD_SCHEMAS[type];
+  }
+  function parseLumioEventPayload(type, data) {
+    return LUMIO_EVENT_PAYLOAD_SCHEMAS[type].safeParse(data);
+  }
   var LUMIO_COMPONENT_TYPES = [
     "Box",
     "VStack",
@@ -35387,6 +36116,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     "EditorFontPicker",
     "EditorChannelRow"
   ];
+  var ACTION_EXECUTE_ERRORS = {
+    /** Malformed request: `action` is not a string or `params` is not an object. */
+    INVALID_REQUEST: -32602,
+    /** This host cannot run actions (no install, or a credential that may not run them). */
+    UNAVAILABLE: -32001,
+    /** The extension does not declare the action's permission, or the caller may not use it. */
+    DENIED: -32002,
+    /** The API does not dispatch this action. */
+    UNKNOWN_ACTION: -32003,
+    /** The API rejected the action's params. */
+    INVALID_PARAMS: -32004,
+    /** The action ran and failed (e.g. its target service is not connected). */
+    FAILED: -32005
+  };
+  var SERVER_FUNCTION_ERRORS = {
+    /** Malformed request: `fn` is not a function name or `params` is not an object. */
+    INVALID_REQUEST: -32602,
+    /** This host cannot call server functions (no install, or a credential that may not call them). */
+    UNAVAILABLE: -32001,
+    /** The caller may not run the function (an `editorOnly` function outside the editor, or missing permission). */
+    DENIED: -32002,
+    /** The install's published version has no server function with this name, or not of this kind. */
+    UNKNOWN_FUNCTION: -32003,
+    /** The API rejected the params (missing or mistyped `arg()` value, invalid row id or column value). */
+    INVALID_PARAMS: -32004,
+    /** The function ran and failed (rate limit, no data schema, storage quota, timeout). */
+    FAILED: -32005
+  };
   var WORKER_METHODS = {
     UI_RENDER: "ui.render",
     UI_READY: "ui.ready",
@@ -35399,7 +36156,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     UI_ACTION: "ui.action",
     SOUND_PLAY: "sound.play",
     SOUND_STOP: "sound.stop",
-    SOUND_LIST: "sound.list"
+    SOUND_LIST: "sound.list",
+    ACTION_EXECUTE: "action.execute"
   };
   var HOST_METHODS = {
     LIFECYCLE_INIT: "lifecycle.init",
@@ -35408,7 +36166,23 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     EVENT_PLATFORM: "event.platform",
     STORAGE_UPDATE: "storage.update",
     THEME_CHANGE: "theme.change",
-    CONFIG_UPDATE: "config.update"
+    CONFIG_UPDATE: "config.update",
+    SERVER_REALTIME: "server.realtime"
+  };
+  var REALTIME_LIMITS = {
+    /** 1–64 characters of `A-Z a-z 0-9 _ . : -`, starting with a letter or digit. */
+    TOPIC_PATTERN: /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}$/,
+    /** Largest serialized payload of one push, in bytes. */
+    MAX_PAYLOAD_BYTES: 16 * 1024,
+    /** Most pushes one handler run may make. */
+    MAX_PUSHES_PER_INVOCATION: 32,
+    /** Pushes per install and minute; pushes over the cap are dropped. */
+    MAX_PUSHES_PER_MINUTE: 300,
+    /**
+     * Published bytes (serialized `{ topic, payload }`) per install and minute;
+     * pushes over the cap are dropped.
+     */
+    MAX_BYTES_PER_MINUTE: 1024 * 1024
   };
 
   // src/hooks/useExtensionStorage.ts
@@ -35485,24 +36259,25 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   var defaultContext = {
     extensionId: null,
     target: null,
-    overlayId: null,
-    interactiveUrl: null
+    overlayId: null
   };
+  function fromInit(p) {
+    return {
+      extensionId: p.extensionId ?? null,
+      target: p.target ?? null,
+      overlayId: p.installId ?? null
+    };
+  }
   function useExtensionContext() {
-    const [context, setContext] = (0, import_react35.useState)(defaultContext);
+    const [context, setContext] = (0, import_react35.useState)(() => {
+      const init = getInitParams();
+      return init ? fromInit(init) : defaultContext;
+    });
     (0, import_react35.useEffect)(() => {
       const bridge2 = getBridge();
       const unsub = bridge2.onNotification(
         HOST_METHODS.LIFECYCLE_INIT,
-        (params) => {
-          const p = params;
-          setContext({
-            extensionId: p.extensionId ?? null,
-            target: p.target ?? null,
-            overlayId: p.installId ?? null,
-            interactiveUrl: p.interactiveUrl ?? null
-          });
-        }
+        (params) => setContext(fromInit(params))
       );
       return unsub;
     }, []);
@@ -35512,7 +36287,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   // src/hooks/useLumioEvent.ts
   var import_react36 = __toESM(require_react());
   function useLumioEvent(eventType) {
-    const [eventData, setEventData] = (0, import_react36.useState)(null);
+    const [eventData, setEventData] = (0, import_react36.useState)(
+      null
+    );
     (0, import_react36.useEffect)(() => {
       const bridge2 = getBridge();
       const unsub = bridge2.onNotification(
@@ -35529,17 +36306,44 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     return eventData;
   }
 
-  // src/hooks/useLumioConfig.ts
+  // src/hooks/useRealtime.ts
   var import_react37 = __toESM(require_react());
+  function useRealtime(topic, cb) {
+    const cbRef = (0, import_react37.useRef)(cb);
+    cbRef.current = cb;
+    (0, import_react37.useEffect)(() => {
+      const bridge2 = getBridge();
+      return bridge2.onNotification(HOST_METHODS.SERVER_REALTIME, (params) => {
+        const p = params;
+        if (p && p.topic === topic) {
+          cbRef.current(p.payload);
+        }
+      });
+    }, [topic]);
+  }
+
+  // src/hooks/useLumioConfig.ts
+  var import_react38 = __toESM(require_react());
   function hasShim() {
     return typeof window !== "undefined" && typeof window.__lumio_config === "function";
   }
+  function fromInit2(p) {
+    return {
+      extension_id: p.extensionId,
+      install_id: p.installId,
+      account_id: p.accountId,
+      target: p.target,
+      permissions: p.permissions,
+      settings: p.settings
+    };
+  }
   function useLumioConfig() {
-    const [config2, setConfigState] = (0, import_react37.useState)(() => {
+    const [config2, setConfigState] = (0, import_react38.useState)(() => {
       if (hasShim()) return window.__lumio_config();
-      return {};
+      const init = getInitParams();
+      return init ? fromInit2(init) : {};
     });
-    (0, import_react37.useEffect)(() => {
+    (0, import_react38.useEffect)(() => {
       if (hasShim()) {
         const unsub2 = window.__lumio_on_config((newConfig) => {
           setConfigState(newConfig);
@@ -35550,23 +36354,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const bridge2 = getBridge();
       const unsub = bridge2.onNotification(
         HOST_METHODS.LIFECYCLE_INIT,
-        (params) => {
-          const p = params;
-          setConfigState({
-            extension_id: p.extensionId,
-            install_id: p.installId,
-            account_id: p.accountId,
-            target: p.target,
-            permissions: p.permissions,
-            settings: p.settings
-          });
-        }
+        (params) => setConfigState(fromInit2(params))
       );
       const unsubConfig = bridge2.onNotification(
         HOST_METHODS.CONFIG_UPDATE,
         (params) => {
           const p = params;
-          setConfigState(p);
+          setConfigState((prev) => ({ ...prev, ...p }));
         }
       );
       return () => {
@@ -35574,7 +36368,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         unsubConfig();
       };
     }, []);
-    const setConfig = (0, import_react37.useCallback)(
+    const setConfig = (0, import_react38.useCallback)(
       (newConfigOrUpdater) => {
         setConfigState((prev) => {
           const next = typeof newConfigOrUpdater === "function" ? newConfigOrUpdater(prev) : newConfigOrUpdater;
@@ -35593,7 +36387,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 
   // src/hooks/useLumioTheme.ts
-  var import_react38 = __toESM(require_react());
+  var import_react39 = __toESM(require_react());
   var DEFAULT_THEME = {
     colors: {
       primary: "#6366f1",
@@ -35617,8 +36411,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     spacing: 8
   };
   function useLumioTheme() {
-    const [theme, setTheme] = (0, import_react38.useState)(DEFAULT_THEME);
-    (0, import_react38.useEffect)(() => {
+    const [theme, setTheme] = (0, import_react39.useState)(() => {
+      const initTheme = getInitParams()?.theme;
+      return initTheme ? { ...DEFAULT_THEME, ...initTheme } : DEFAULT_THEME;
+    });
+    (0, import_react39.useEffect)(() => {
       const bridge2 = getBridge();
       const unsubInit = bridge2.onNotification(
         HOST_METHODS.LIFECYCLE_INIT,
@@ -35647,26 +36444,29 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 
   // src/hooks/useLumioIdentity.ts
-  var import_react39 = __toESM(require_react());
+  var import_react40 = __toESM(require_react());
   var defaultIdentity = {
     userId: null,
     accountId: null,
     role: null
   };
+  function fromInit3(p) {
+    return {
+      userId: p.userId ?? null,
+      accountId: p.accountId ?? null,
+      role: p.role ?? null
+    };
+  }
   function useLumioIdentity() {
-    const [identity2, setIdentity] = (0, import_react39.useState)(defaultIdentity);
-    (0, import_react39.useEffect)(() => {
+    const [identity2, setIdentity] = (0, import_react40.useState)(() => {
+      const init = getInitParams();
+      return init ? fromInit3(init) : defaultIdentity;
+    });
+    (0, import_react40.useEffect)(() => {
       const bridge2 = getBridge();
       const unsub = bridge2.onNotification(
         HOST_METHODS.LIFECYCLE_INIT,
-        (params) => {
-          const p = params;
-          setIdentity({
-            userId: p.userId ?? null,
-            accountId: p.accountId ?? null,
-            role: p.role ?? null
-          });
-        }
+        (params) => setIdentity(fromInit3(params))
       );
       return unsub;
     }, []);
@@ -35674,27 +36474,26 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 
   // src/hooks/useLumioAction.ts
-  var import_react40 = __toESM(require_react());
+  var import_react41 = __toESM(require_react());
   function useLumioAction(action2) {
-    const [data, setData] = (0, import_react40.useState)(null);
-    const [isLoading, setIsLoading] = (0, import_react40.useState)(false);
-    const [error48, setError] = (0, import_react40.useState)(null);
-    const actionRef = (0, import_react40.useRef)(action2);
-    actionRef.current = action2;
-    const execute = (0, import_react40.useCallback)(
-      (params = {}) => {
+    const [data, setData] = (0, import_react41.useState)(null);
+    const [isLoading, setIsLoading] = (0, import_react41.useState)(false);
+    const [error48, setError] = (0, import_react41.useState)(null);
+    const execute = (0, import_react41.useCallback)(
+      async (params = {}) => {
         setIsLoading(true);
         setError(null);
-        const bridge2 = getBridge();
-        bridge2.request("action.execute", { action: action2, params }).then((result) => {
-          setIsLoading(false);
-          setData(result ?? null);
+        const request = { action: action2, params };
+        try {
+          const result = await getBridge().request(WORKER_METHODS.ACTION_EXECUTE, request);
+          setData(result?.data ?? null);
           setError(null);
-        }).catch((err) => {
-          setIsLoading(false);
+        } catch (err) {
           setError(err instanceof Error ? err.message : "Unknown error");
           setData(null);
-        });
+        } finally {
+          setIsLoading(false);
+        }
       },
       [action2]
     );
@@ -35702,17 +36501,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 
   // src/hooks/useLumioSound.ts
-  var import_react41 = __toESM(require_react());
+  var import_react42 = __toESM(require_react());
   function useLumioSound() {
-    const playSound = (0, import_react41.useCallback)(async (soundId, volume) => {
+    const playSound = (0, import_react42.useCallback)(async (soundId, volume) => {
       const bridge2 = getBridge();
       await bridge2.request(WORKER_METHODS.SOUND_PLAY, { sound_id: soundId, volume });
     }, []);
-    const stopSound = (0, import_react41.useCallback)(async (soundId) => {
+    const stopSound = (0, import_react42.useCallback)(async (soundId) => {
       const bridge2 = getBridge();
       await bridge2.request(WORKER_METHODS.SOUND_STOP, { sound_id: soundId });
     }, []);
-    const getSounds = (0, import_react41.useCallback)(async () => {
+    const getSounds = (0, import_react42.useCallback)(async () => {
       const bridge2 = getBridge();
       const result = await bridge2.request(WORKER_METHODS.SOUND_LIST, {});
       return result ?? [];
@@ -35721,14 +36520,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
 
   // src/hooks/useQuery.ts
-  var import_react42 = __toESM(require_react());
+  var import_react43 = __toESM(require_react());
   function useQuery(functionName, params) {
-    const [data, setData] = (0, import_react42.useState)(null);
-    const [isLoading, setIsLoading] = (0, import_react42.useState)(false);
-    const [error48, setError] = (0, import_react42.useState)(null);
-    const fnRef = (0, import_react42.useRef)(functionName);
+    const [data, setData] = (0, import_react43.useState)(null);
+    const [isLoading, setIsLoading] = (0, import_react43.useState)(false);
+    const [error48, setError] = (0, import_react43.useState)(null);
+    const fnRef = (0, import_react43.useRef)(functionName);
     fnRef.current = functionName;
-    const sendQuery = (0, import_react42.useCallback)(() => {
+    const sendQuery = (0, import_react43.useCallback)(() => {
       setIsLoading(true);
       setError(null);
       const bridge2 = getBridge();
@@ -35742,19 +36541,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         setData(null);
       });
     }, [functionName, params]);
-    (0, import_react42.useEffect)(() => {
+    (0, import_react43.useEffect)(() => {
       sendQuery();
     }, [sendQuery]);
     return { data, isLoading, error: error48, refetch: sendQuery };
   }
 
   // src/hooks/useMutation.ts
-  var import_react43 = __toESM(require_react());
+  var import_react44 = __toESM(require_react());
   function useMutation(functionName) {
-    const [data, setData] = (0, import_react43.useState)(null);
-    const [isLoading, setIsLoading] = (0, import_react43.useState)(false);
-    const [error48, setError] = (0, import_react43.useState)(null);
-    const sendMutation = (0, import_react43.useCallback)(
+    const [data, setData] = (0, import_react44.useState)(null);
+    const [isLoading, setIsLoading] = (0, import_react44.useState)(false);
+    const [error48, setError] = (0, import_react44.useState)(null);
+    const sendMutation = (0, import_react44.useCallback)(
       (params = {}) => {
         setIsLoading(true);
         setError(null);
@@ -35774,11 +36573,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       },
       [functionName]
     );
-    const mutateAsync = (0, import_react43.useCallback)(
+    const mutateAsync = (0, import_react44.useCallback)(
       (params) => sendMutation(params),
       [sendMutation]
     );
-    const mutate = (0, import_react43.useCallback)(
+    const mutate = (0, import_react44.useCallback)(
       (params) => {
         sendMutation(params).catch(() => {
         });
@@ -35791,8 +36590,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   // src/animation/keyframes.ts
   var registry2 = /* @__PURE__ */ new Map();
   var counter = 0;
-  function camelToKebab(str) {
-    return str.replace(/([A-Z])/g, (match) => `-${match.toLowerCase()}`);
+  function camelToKebab(str2) {
+    return str2.replace(/([A-Z])/g, (match) => `-${match.toLowerCase()}`);
   }
   function keyframesToCSS(name, def) {
     const stops = Object.entries(def).map(([stop, block]) => {
@@ -35874,7 +36673,7 @@ ${stops}
   }
 
   // src/animation/Animated.tsx
-  var import_react44 = __toESM(require_react());
+  var import_react45 = __toESM(require_react());
   function resolveAnimation(name) {
     if (name === void 0) return void 0;
     try {
@@ -35895,16 +36694,16 @@ ${stops}
     visible = true,
     onAnimationEnd
   }) {
-    const [phase, setPhase] = (0, import_react44.useState)(() => visible ? "in" : "idle");
-    const prevVisibleRef = (0, import_react44.useRef)(visible);
-    const timerRef = (0, import_react44.useRef)(null);
+    const [phase, setPhase] = (0, import_react45.useState)(() => visible ? "in" : "idle");
+    const prevVisibleRef = (0, import_react45.useRef)(visible);
+    const timerRef = (0, import_react45.useRef)(null);
     function clearTimer() {
       if (timerRef.current !== null) {
         clearTimeout(timerRef.current);
         timerRef.current = null;
       }
     }
-    (0, import_react44.useEffect)(() => {
+    (0, import_react45.useEffect)(() => {
       const prevVisible = prevVisibleRef.current;
       prevVisibleRef.current = visible;
       if (visible && !prevVisible) {
@@ -35915,7 +36714,7 @@ ${stops}
         setPhase("out");
       }
     }, [visible]);
-    (0, import_react44.useEffect)(() => {
+    (0, import_react45.useEffect)(() => {
       if (phase === "in") {
         const totalDuration = duration3 + delay;
         if (loopProp !== void 0) {
@@ -35969,11 +36768,11 @@ ${stops}
         animationStyles.animationIterationCount = 1;
       }
     }
-    return import_react44.default.createElement("Box", { style: animationStyles }, children);
+    return import_react45.default.createElement("Box", { style: animationStyles }, children);
   }
 
   // src/animation/useAnimation.ts
-  var import_react45 = __toESM(require_react());
+  var import_react46 = __toESM(require_react());
   function resolvePreset(name) {
     try {
       return getPreset(name);
@@ -35982,10 +36781,10 @@ ${stops}
     }
   }
   function useAnimation() {
-    const [isAnimating, setIsAnimating] = (0, import_react45.useState)(false);
-    const [currentAnimation, setCurrentAnimation] = (0, import_react45.useState)(null);
-    const [style, setStyle] = (0, import_react45.useState)({});
-    const trigger = (0, import_react45.useCallback)((preset, duration3 = 300) => {
+    const [isAnimating, setIsAnimating] = (0, import_react46.useState)(false);
+    const [currentAnimation, setCurrentAnimation] = (0, import_react46.useState)(null);
+    const [style, setStyle] = (0, import_react46.useState)({});
+    const trigger = (0, import_react46.useCallback)((preset, duration3 = 300) => {
       const animationName = resolvePreset(preset);
       setIsAnimating(true);
       setCurrentAnimation(preset);
@@ -35996,7 +36795,7 @@ ${stops}
       });
       return animationName;
     }, []);
-    const reset = (0, import_react45.useCallback)(() => {
+    const reset = (0, import_react46.useCallback)(() => {
       setIsAnimating(false);
       setCurrentAnimation(null);
       setStyle({});
@@ -36009,12 +36808,21 @@ ${stops}
     if (lower.endsWith(".woff")) return "woff";
     return "truetype";
   }
+  var FAMILY_RE = /^[\w -]+$/;
+  function escapeCssUrl(src) {
+    return src.replace(/[\\"\n\r\f]/g, (c) => `\\${c}`);
+  }
   function buildFontFace(family, src, display, weight, style) {
+    if (!FAMILY_RE.test(family)) {
+      throw new Error(
+        `Invalid font family "${family}": only letters, digits, spaces, "-" and "_" are allowed.`
+      );
+    }
     const format = formatFromPath(src);
     const lines = [
       "@font-face {",
       `  font-family: "${family}";`,
-      `  src: url("${src}") format("${format}");`,
+      `  src: url("${escapeCssUrl(src)}") format("${format}");`,
       `  font-display: ${display};`
     ];
     if (weight !== void 0) {
@@ -36130,8 +36938,14 @@ ${stops}
   };
 
   // src/server/queryRows.ts
-  function queryRows(table) {
-    return { __type: "queryRows", table };
+  function queryRows(table, opts) {
+    const def = { __type: "queryRows", table };
+    if (opts?.filter !== void 0) def.filter = opts.filter;
+    if (opts?.orderBy !== void 0) def.orderBy = opts.orderBy;
+    if (opts?.orderDir !== void 0) def.orderDir = opts.orderDir;
+    if (opts?.limit !== void 0) def.limit = opts.limit;
+    if (opts?.offset !== void 0) def.offset = opts.offset;
+    return def;
   }
 
   // src/server/insertRow.ts
@@ -36167,13 +36981,13 @@ ${stops}
 
   // src/server/handlers.ts
   function query(config2) {
-    return { __type: "query", args: config2.args, handler: config2.handler };
+    return { __type: "query", args: config2.args, editorOnly: config2.editorOnly, handler: config2.handler };
   }
   function mutation(config2) {
-    return { __type: "mutation", args: config2.args, handler: config2.handler };
+    return { __type: "mutation", args: config2.args, editorOnly: config2.editorOnly, handler: config2.handler };
   }
   function action(config2) {
-    return { __type: "action", args: config2.args, handler: config2.handler };
+    return { __type: "action", args: config2.args, editorOnly: config2.editorOnly, handler: config2.handler };
   }
 
   // src/server/fetchAction.ts
@@ -36260,7 +37074,7 @@ ${stops}
   }
 
   // src/renderer/render.ts
-  var import_react46 = __toESM(require_react());
+  var import_react47 = __toESM(require_react());
   var import_react_reconciler = __toESM(require_react_reconciler());
 
   // src/renderer/reconciler.ts
@@ -36321,7 +37135,12 @@ ${stops}
   }
 
   // src/renderer/host-config.ts
-  function createHostConfig(registry3) {
+  var NO_EVENT_PRIORITY = 0;
+  var DISCRETE_EVENT_PRIORITY = 2;
+  var LEGACY_UPDATE_PRIORITY = 16;
+  function createHostConfig(registry3, options = {}) {
+    const syncUpdates = options.syncUpdates === true;
+    let currentUpdatePriority = NO_EVENT_PRIORITY;
     return {
       supportsMutation: true,
       supportsPersistence: false,
@@ -36443,13 +37262,15 @@ ${stops}
         return null;
       },
       // Priority methods required by react-reconciler 0.32
-      setCurrentUpdatePriority() {
+      setCurrentUpdatePriority(priority) {
+        if (syncUpdates) currentUpdatePriority = priority;
       },
       getCurrentUpdatePriority() {
-        return 16;
+        return syncUpdates ? currentUpdatePriority : LEGACY_UPDATE_PRIORITY;
       },
       resolveUpdatePriority() {
-        return 16;
+        if (!syncUpdates) return LEGACY_UPDATE_PRIORITY;
+        return currentUpdatePriority !== NO_EVENT_PRIORITY ? currentUpdatePriority : DISCRETE_EVENT_PRIORITY;
       },
       // Transition support (not used — Lumio SDK does not support transitions)
       NotPendingTransition: null,
@@ -36502,11 +37323,12 @@ ${stops}
 
   // src/renderer/render.ts
   var hasRendered2 = false;
-  function createReconcilerAndRender(element) {
+  function mountRoot(element, options = {}) {
     const registry3 = getRegistry();
     const bridge2 = getBridge();
-    const hostConfig = createHostConfig(registry3);
+    const hostConfig = createHostConfig(registry3, { syncUpdates: options.syncUpdates });
     const reconciler = (0, import_react_reconciler.default)(hostConfig);
+    const { flushSyncFromReconciler } = reconciler;
     let lastFingerprint = "";
     const container = {
       children: [],
@@ -36545,16 +37367,35 @@ ${stops}
       null
       // transitionCallbacks
     );
-    bridge2.onNotification(HOST_METHODS.EVENT_CALLBACK, (params) => {
+    const stopCallbacks = bridge2.onNotification(HOST_METHODS.EVENT_CALLBACK, (params) => {
       const { handlerId, args } = params;
       try {
         registry3.invoke(handlerId, args);
       } catch {
       }
     });
-    reconciler.updateContainer(element, root, null, () => {
-      bridge2.notify("ui.ready", {});
+    const flushSync = (fn) => {
+      if (options.syncUpdates) {
+        flushSyncFromReconciler(fn);
+        reconciler.flushPassiveEffects();
+      } else {
+        fn();
+      }
+    };
+    flushSync(() => {
+      reconciler.updateContainer(element, root, null, () => {
+        bridge2.notify("ui.ready", {});
+      });
     });
+    return {
+      flushSync,
+      unmount() {
+        stopCallbacks();
+        flushSync(() => {
+          reconciler.updateContainer(null, root, null, null);
+        });
+      }
+    };
   }
   var Lumio2 = {
     render(input, _options) {
@@ -36562,12 +37403,82 @@ ${stops}
         throw new Error("Lumio.render() can only be called once");
       }
       hasRendered2 = true;
-      const element = typeof input === "function" ? (0, import_react46.createElement)(input) : input;
-      createReconcilerAndRender(element);
+      const element = typeof input === "function" ? (0, import_react47.createElement)(input) : input;
+      mountRoot(element);
     }
   };
 
+  // src/runtime/lockdown.ts
+  var BLOCKED_GLOBAL_PROPS = [
+    // Origin-scoped storage
+    "indexedDB",
+    "caches",
+    // Cross-context channels on the shared origin
+    "BroadcastChannel",
+    // Nested workers would start with a fresh, un-locked global
+    "Worker",
+    "SharedWorker",
+    // Legacy origin-scoped file systems (Chromium)
+    "webkitRequestFileSystem",
+    "webkitRequestFileSystemSync",
+    "webkitResolveLocalFileSystemURL",
+    "webkitResolveLocalFileSystemSyncURL"
+  ];
+  var BLOCKED_NAVIGATOR_PROPS = [
+    // StorageManager — quota, persistence and the origin-private file system
+    "storage",
+    // Web Locks are shared by every context on the origin
+    "locks",
+    // Service workers are registered per origin
+    "serviceWorker",
+    // Storage Buckets (Chromium 122+) — each bucket opens its own indexedDB,
+    // caches and getDirectory(), all shared across the origin
+    "storageBuckets"
+  ];
+  function blockedError(prop) {
+    const message = `${prop} is not available in the Lumio extension sandbox`;
+    return typeof DOMException === "function" ? new DOMException(message, "SecurityError") : new Error(message);
+  }
+  function blockProperty(target, prop) {
+    const descriptor = {
+      get() {
+        throw blockedError(prop);
+      },
+      set() {
+        throw blockedError(prop);
+      },
+      enumerable: false,
+      configurable: false
+    };
+    let obj = Object.getPrototypeOf(target);
+    while (obj && obj !== Object.prototype) {
+      if (Object.prototype.hasOwnProperty.call(obj, prop)) {
+        try {
+          Object.defineProperty(obj, prop, descriptor);
+        } catch {
+        }
+      }
+      obj = Object.getPrototypeOf(obj);
+    }
+    try {
+      Object.defineProperty(target, prop, descriptor);
+    } catch {
+    }
+  }
+  function lockDownWorkerGlobal(scope = globalThis) {
+    const nav = scope.navigator;
+    for (const prop of BLOCKED_GLOBAL_PROPS) {
+      blockProperty(scope, prop);
+    }
+    if (nav && typeof nav === "object") {
+      for (const prop of BLOCKED_NAVIGATOR_PROPS) {
+        blockProperty(nav, prop);
+      }
+    }
+  }
+
   // src/runtime/worker-entry.ts
+  lockDownWorkerGlobal();
   var LumioSDK = {
     ...src_exports,
     Lumio: Lumio2
@@ -36590,11 +37501,12 @@ ${stops}
   var bridge = getBridge();
   var extensionLoaded = false;
   bridge.onNotification(HOST_METHODS.LIFECYCLE_INIT, (params) => {
-    const initParams = params;
+    const initParams2 = params;
+    setInitParams(initParams2);
     if (extensionLoaded) return;
-    if (initParams.bundleCode) {
+    if (initParams2.bundleCode) {
       try {
-        (0, eval)(initParams.bundleCode);
+        (0, eval)(initParams2.bundleCode);
         extensionLoaded = true;
       } catch (err) {
         bridge.notify("ui.error", {
@@ -36604,12 +37516,12 @@ ${stops}
       }
       return;
     }
-    if (!initParams.bundleUrl) {
+    if (!initParams2.bundleUrl) {
       bridge.notify("ui.error", { code: "MISSING_BUNDLE", message: "No bundle URL or code provided" });
       return;
     }
     try {
-      importScripts(initParams.bundleUrl);
+      importScripts(initParams2.bundleUrl);
       extensionLoaded = true;
     } catch (err) {
       bridge.notify("ui.error", {